Privacy Policy.

1. Who is responsible

We are the controller under the General Data Protection Regulation (GDPR). Please use these contact details for privacy requests. No separate data protection officer has been appointed.

2. Visiting the website

Our hosting provider, Vercel Inc., processes technical connection data needed to deliver and secure the website. This may include your IP address, requested URL, date and time, browser and device information, referring page, response status and technical error data.

We use this information to deliver content, maintain availability, investigate errors and prevent abuse. The legal basis is our legitimate interest in operating a secure, reliable website under Article 6(1)(f) GDPR. Security logs are retained for the period needed to investigate incidents and operate the service, subject to the provider’s applicable retention settings. Data relevant to a specific incident may be retained until the investigation and any related claims are resolved.

Information from Vercel: Privacy Notice and Data Processing Addendum.

3. Joining the waitlist

The waitlist is voluntary and free. We ask for your email address and your express consent to receive Orelio early-access and launch emails, including occasional release countdowns. We do not use this consent for unrelated advertising or third-party newsletters.

We store your email address, request time, the consent wording and version, the confirmation time if you confirm, and technical token and request-limit information. We use Supabase to store this information in the database region selected in Ireland (EU). The legal basis for waitlist updates is Article 6(1)(a) GDPR.

We use double opt-in: after a request, Resend sends a neutral confirmation email. You must open its link and press the confirmation button before your address becomes eligible for updates. Confirmation links expire after 48 hours. Unconfirmed entries are not included in the confirmed waitlist. Existing entries without confirmation are also excluded.

Confirmation and unsubscribe links contain confidential random or cryptographically generated tokens. Our database stores token hashes for verification. Limited request timestamps and counters help prevent repeated emails and abuse; this security processing relies on Article 6(1)(f) GDPR. We do not store a separate visitor IP address in the waitlist table.

Providing your address is necessary to join, but you are under no legal or contractual obligation to do so. Not joining has no effect on access to the public website. We do not make automated decisions with legal or similarly significant effects and do not profile waitlist members.

Supabase: Privacy Policy and Data Processing Addendum.

4. Email delivery and withdrawal

Resend (Plus Five Five, Inc.) processes recipient addresses, email content and delivery information to send our confirmation and waitlist emails. We do not create a separate Resend marketing contact list as part of signup. We do not add tracking pixels or click-tracking links in our email templates.

You can withdraw your consent at any time through the unsubscribe link in our waitlist emails or by contacting contact@getorelio.com. The link opens a page where you can remove your entry without signing in. We then stop waitlist updates and delete your entry from the active waitlist. Withdrawal does not affect processing carried out lawfully before withdrawal.

Resend retains delivery content and logs according to its applicable plan; its standard Free, Pro and Scale retention is 30 days. A removal from our active waitlist does not immediately erase a previously delivered message from your mailbox or the provider’s delivery logs. Resend: Privacy Policy, Data Processing Addendum and retention information.

5. How long we keep information

• Confirmation links expire after 48 hours. Unconfirmed requests are deleted by our daily cleanup after seven days without a new request.
• Confirmed entries are kept while the waitlist is operating, unless you unsubscribe earlier, and are deleted no later than three months after the waitlist ends.
• Unsubscribing removes the active waitlist entry, including its consent and token data. We do not retain a separate marketing profile.
• Technical backups and delivery logs may remain until their normal provider retention cycles expire. They are not used to continue sending updates after withdrawal.

If information must be preserved for a legal obligation or a specific dispute, it is limited to that purpose for the applicable period. We do not keep waitlist addresses indefinitely for future marketing.

6. Optional Vercel Web Analytics

With your prior consent, we use Vercel Web Analytics to measure page visits and improve the website. Declining does not restrict any website or waitlist function. We load the analytics integration only after you select “Allow analytics”. It is not activated during local development.

Vercel processes visit timestamps, page paths, referring information, approximate location and browser, operating-system and device information. Its visitor identification uses a hash derived from request information rather than advertising cookies; the visitor-session identifier is discarded after 24 hours. Aggregated statistics may remain after that period. The legal basis is Article 6(1)(a) GDPR and, where an access to your device requires it, section 25(1) TDDDG.

We do not send email addresses, form contents, confirmation tokens or unsubscribe tokens as analytics events. We remove query strings and URL fragments from events and exclude confirmation and unsubscribe pages. We do not enable advertising pixels or cross-site advertising profiles.

You can change or withdraw your choice at any time using Privacy choices. Withdrawal stops new analytics events. Information already aggregated cannot necessarily be attributed to you for individual deletion. See Vercel’s analytics privacy information.

7. Browser storage and local media

We store your selected light or dark appearance in localStorage under “orelio-appzen-theme”. We also store your analytics choice, its version and date under “orelio-analytics-consent-v1” so we can respect and demonstrate the choice made in that browser. These entries remain until changed or cleared in your browser. Clearing them may cause us to ask for your choice again; it does not unsubscribe you from the waitlist.

These preference entries serve the settings you request and the management of your privacy choices. Where applicable, access is based on the necessary-function exception in section 25(2)(2) TDDDG; associated personal-data processing is based on Article 6(1)(f) GDPR. Optional analytics remains subject to the separate consent described above. Fonts, app mockups and hero videos are served with the website rather than embedded from external video or font platforms. We use no external CAPTCHA service.

8. Recipients and international processing

Our hosting, database and email providers process data for the purposes described above and may use subprocessors for infrastructure, support and security. The Irish database location does not mean all provider support, hosting and email processing takes place exclusively in the EU. Processing may also involve the United States or other countries.

Applicable transfer safeguards are described in the providers’ data processing terms. Depending on the recipient and transfer, these include a European Commission adequacy decision, such as the EU–US Data Privacy Framework for a currently certified recipient, or the European Commission’s Standard Contractual Clauses with any required supplementary measures. You can request information about the safeguards relevant to your data and a copy of applicable clauses from us. Provider and subprocessor information is available through the data processing terms linked above.

We do not sell waitlist addresses. We may disclose information to public authorities where legally required, or to professional advisers where necessary for a specific legal matter.

9. Your rights

Subject to the applicable conditions, you have rights of access, rectification, erasure, restriction of processing, data portability and objection under Articles 15–21 GDPR. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time. Consent can be withdrawn at any time, as explained above.

Please contact contact@getorelio.com. We normally respond within one month. You may also lodge a complaint with a data protection supervisory authority, including in the country where you live or work. Our local supervisory authority is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany.

10. Contacting us and changes

If you contact us by email or phone, we process your contact details and the information you provide to respond. Depending on your request, the basis is Article 6(1)(b) GDPR for pre-contractual enquiries or Article 6(1)(f) GDPR for other correspondence. We keep correspondence until your enquiry is resolved and any applicable documentation obligations or specific legal claims no longer require it.

We may update this notice when the website or its services change. Material changes to the purpose of consent-based processing require a new legal basis or renewed consent, rather than simply changing this page.